diff options
| -rw-r--r-- | usr.sbin/tcpdump/tcpdump.8 | 38 |
1 files changed, 36 insertions, 2 deletions
diff --git a/usr.sbin/tcpdump/tcpdump.8 b/usr.sbin/tcpdump/tcpdump.8 index acbddfd5079..73c67608974 100644 --- a/usr.sbin/tcpdump/tcpdump.8 +++ b/usr.sbin/tcpdump/tcpdump.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: tcpdump.8,v 1.29 2001/09/03 13:27:14 jakob Exp $ +.\" $OpenBSD: tcpdump.8,v 1.30 2002/03/23 01:35:06 frantzen Exp $ .\" .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996 .\" The Regents of the University of California. All rights reserved. @@ -288,7 +288,8 @@ qualifier, .Cm src or dst is assumed. For null link layers (i.e., point-to-point protocols such as -.Tn SLIP ) +.Tn SLIP +or the pflog header) the .Cm inbound and @@ -652,6 +653,39 @@ True if either the .Tn DECNET source or destination address is .Ar host . +.It Cm ifname Ar interface +True if the packet was logged as coming from the specified interface (applies +only to packets logged by the PF firewall). +.It Cm on Ar interface +Synonymous with the +.Ar ifname +modifier. +.It Cm rnr Ar num +True if the packet was logged as matching the specified PF rule number +(applies only to packets logged by the PF firewall). +.It Cm rulenum Ar num +Synonomous with the +.Ar rnr +modifier. +.It Cm reason Ar code +True if the packet was logged with the specified PF reason code. The known +codes are: +.Ar match , +.Ar bad-offset , +.Ar fragment , +.Ar short , +.Ar normalize , +and +.Ar memory . +(applies only to packets logged by the PF firewall). +.It Cm action +.Ar act +True if PF took the specified action when the packet was logged. Known actions +are: +.Ar pass , +and +.Ar block . +(applies only to packets logged by the PF firewall). .It Xo Cm ip , .Cm arp , .Cm rarp , |